// Package blindsecp256k1 implements the Blind signature scheme explained at
// http://www.isecure-journal.com/article_39171_47f9ec605dd3918c2793565ec21fcd7a.pdf
package blindsecp256k1

// WARNING: WIP code

import (
	"bytes"
	"crypto/rand"
	"math/big"

	"github.com/ethereum/go-ethereum/crypto/secp256k1"
)

type Point struct {
	X *big.Int
	Y *big.Int
}

var (
	G *Point = &Point{
		X: secp256k1.S256().Gx,
		Y: secp256k1.S256().Gy,
	}

	N *big.Int = secp256k1.S256().N
)

func (p *Point) Add(q *Point) *Point {
	x, y := secp256k1.S256().Add(p.X, p.Y, q.X, q.Y)
	return &Point{
		X: x,
		Y: y,
	}
}

func (p *Point) Mul(scalar *big.Int) *Point {
	x, y := secp256k1.S256().ScalarMult(p.X, p.Y, scalar.Bytes())
	return &Point{
		X: x,
		Y: y,
	}
}

func newRand() *big.Int {
	var b [32]byte
	_, err := rand.Read(b[:])
	if err != nil {
		panic(err)
	}
	bi := new(big.Int).SetBytes(b[:])
	return new(big.Int).Mod(bi, N)
}

type PrivateKey big.Int
type PublicKey Point

func NewPrivateKey() *PrivateKey {
	k := newRand()
	sk := PrivateKey(*k)
	return &sk
}

func (sk *PrivateKey) BigInt() *big.Int {
	return (*big.Int)(sk)
}

func (sk *PrivateKey) Public() *PublicKey {
	Q := G.Mul(sk.BigInt())
	pk := PublicKey(*Q)
	return &pk
}

func (pk *PublicKey) Point() *Point {
	return (*Point)(pk)
}

type SignerPrivateData struct {
	d *PrivateKey
	k *big.Int
}
type SignerPublicData struct {
	// Q is the Signer Public Key
	Q *PublicKey // = skG
	R *Point     // = kG
}

func NewSigner() *SignerPrivateData {
	sk := NewPrivateKey()
	k := newRand()
	return &SignerPrivateData{
		d: sk,
		k: k,
	}
}

func (signer *SignerPrivateData) PublicData() *SignerPublicData {
	return &SignerPublicData{
		Q: signer.d.Public(), // Q = dG
		R: G.Mul(signer.k),   // R = kG
	}
}

func (signer *SignerPrivateData) BlindSign(mBlinded *big.Int) *big.Int {
	// TODO add pending checks
	// s' = d(m') + k
	sBlind := new(big.Int).Add(
		new(big.Int).Mul(signer.d.BigInt(), mBlinded),
		signer.k)
	return sBlind
}

type UserSecretData struct {
	a *big.Int
	b *big.Int
	c *big.Int

	F *Point // public
}

func Blind(m *big.Int, signer *SignerPublicData) (*big.Int, *UserSecretData) {
	u := &UserSecretData{}
	u.a = newRand()
	u.b = newRand()
	u.c = newRand()
	binv := new(big.Int).ModInverse(u.b, N)

	// F = b^-1 R + a b^-1 Q + c G
	bR := signer.R.Mul(binv)
	abinv := new(big.Int).Mul(u.a, binv)
	abinv = new(big.Int).Mod(abinv, N)
	abQ := signer.Q.Point().Mul(abinv)
	cG := G.Mul(u.c)
	u.F = bR.Add(abQ).Add(cG)
	// TODO check F==O

	r := new(big.Int).Mod(u.F.X, N)

	// m' = br(m)+a
	br := new(big.Int).Mul(u.b, r)
	brm := new(big.Int).Mul(br, m)
	mBlinded := new(big.Int).Add(brm, u.a)
	mBlinded = new(big.Int).Mod(mBlinded, N)
	return mBlinded, u
}

type Signature struct {
	S *big.Int
	F *Point
}

func Unblind(sBlind, m *big.Int, u *UserSecretData) *Signature {
	// s = b^-1 s' + c
	binv := new(big.Int).ModInverse(u.b, N)
	bs := new(big.Int).Mul(binv, sBlind)
	s := new(big.Int).Add(bs, u.c)
	s = new(big.Int).Mod(s, N)

	return &Signature{
		S: s,
		F: u.F,
	}
}

func Verify(m *big.Int, signature *Signature, q *PublicKey) bool {
	// TODO add pending checks
	sG := G.Mul(signature.S) // sG

	r := new(big.Int).Mod(signature.F.X, N) // r = Fx mod N
	rm := new(big.Int).Mul(r, m)
	rm = new(big.Int).Mod(rm, N)
	rmQ := q.Point().Mul(rm)
	rmQF := rmQ.Add(signature.F) // rmQ + F

	// check sG == rmQ + F
	if bytes.Equal(sG.X.Bytes(), rmQF.X.Bytes()) &&
		bytes.Equal(sG.Y.Bytes(), rmQF.Y.Bytes()) {
		return true
	}
	return false
}